On 05/29/2013 11:30 AM, Andrew Haley wrote:
On 05/29/13 10:13, Florian Weimer wrote:
The existence of the Class-Path attribute is not widely known, and I was
surprised to see it mentioned in the policy.
Yes it is, it's very well-known, and is almost universally rejected.
It bakes hard paths into jarfiles and overrides -classpath. In other
words, it has similar disadvantages to -RPATH.
I finally experimented with this:
<https://github.com/fweimer/classpath-manifest-override>
The gist appears to be that overriding Class-Path entries is possible if
the main class is not executed with the -jar option. We generally don't
do that in Fedora. Does this mean Class-Path is still unacceptable?
It's just that I found it extremely usable in the past.
What are the alternatives?
I built an application using Maven, and it uses the default
<type>bundle</type> dependency, so Maven copies the class files of the
dependencies into the application JAR. As a result, the JAR just works,
but this is like static linking, with all its problems. Curiously, the
Fedora packaging guidelines do not discuss this at all, as far as I can
tell.
The spec file is here:
<https://github.com/victims/victims-client-java/blob/master/victims-client-java.spec>
As you can see, I use the usual Maven packaging framework.
--
Florian Weimer / Red Hat Product Security Team
--
java-devel mailing list
java-devel@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/java-devel
